Logger.exe

type: OtherMSBinaries

A logging configuration tool from the Windows Kits used to start and manage process logging.

Full path

C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\logger.exe
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\logger.exe
C:\Program Files\Windows Kits\10\Debuggers\x86\logger.exe
C:\Program Files\Windows Kits\10\Debuggers\x64\logger.exe

Commands

ExecuteUser T1202
Executes an abitrary command via a signed binary to evade detection.
```
logger.exe RUN "{CMD}"
```
Executes the command specified after the RUN parameter as a child of logger.exe.
os: Windows
Execute: CMD
ExecuteUser T1202
Executes an abitrary command via a signed binary to evade detection.
```
logger.exe RUNW "{CMD}"
```
Executes the command specified after the RUNW parameter as a child of logger.exe.
os: Windows
Execute: CMD
ExecuteUser T1202
Executes an abitrary command via a signed binary to evade detection.
```
logger.exe "{CMD}"
```
Executes the command specified as a child of logger.exe.
os: Windows
Execute: CMD

Resources

https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/logger

acknowledgement: Avihay Eldad @AvihayEldad